Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 00:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9422d25001d2c78da94d02e0ece1f35af370b0787833be5d183b44ba42aef98eN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9422d25001d2c78da94d02e0ece1f35af370b0787833be5d183b44ba42aef98eN.exe
-
Size
454KB
-
MD5
d827f3de086e0b07fd833612293e94b0
-
SHA1
02bc4a481d6e0164784fe5302275c424569962ea
-
SHA256
9422d25001d2c78da94d02e0ece1f35af370b0787833be5d183b44ba42aef98e
-
SHA512
d4f10480878c3221e7cf87f0ce176eee6d629d3169777caf04cc0710207f1a57a5e027daee59489fa2263ba766440b65b26d649790bba56e799174c3a82539af
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeqi:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1916-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-81-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-102-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2544-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-185-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1952-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-269-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1156-275-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2432-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-454-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-481-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2216-597-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2520-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-670-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1224-707-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2152-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-753-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1080-785-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1472-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-1013-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1624-1076-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2104-1267-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/264-1342-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2428 rlrrlrr.exe 1000 bnbbhh.exe 2312 9bttbb.exe 2752 5rfxfll.exe 2720 3nhhnt.exe 2624 3dpjd.exe 2784 9lrxlrr.exe 2548 nbtnhh.exe 2684 ffrrlll.exe 2544 1ntnnn.exe 1588 3rlxlll.exe 1148 nbhhhh.exe 1900 vpddj.exe 1552 9hbbhb.exe 2420 pjdjp.exe 584 3bbbbh.exe 1980 ddvjv.exe 1988 rrlxffx.exe 2872 nhhbtn.exe 2996 5lfrrxl.exe 1952 hbnnnb.exe 712 jjdpd.exe 2964 9bnhhb.exe 448 5pjvv.exe 1660 rfrrxxl.exe 1292 9dvdj.exe 876 bhbnht.exe 1028 3vjpv.exe 2480 nhnttt.exe 1156 nhbbhn.exe 2208 xxrxxfr.exe 2324 nhbbnb.exe 2432 hhnbbh.exe 2308 frrrxrx.exe 2024 bbtntb.exe 1920 9tbtbb.exe 2608 dpjjj.exe 2712 xrxxxrf.exe 2708 5nbbbb.exe 2672 tnhhnn.exe 2520 pjvvv.exe 2940 frxrxxx.exe 2692 5rrrrlr.exe 2512 1tttht.exe 2572 vjvvj.exe 2556 jjdpj.exe 2268 rrlrxxf.exe 1720 7nhhnh.exe 1084 hbhbbb.exe 1508 vjvjp.exe 2336 1rflllr.exe 1904 tnbhnn.exe 1764 hthbbb.exe 2604 pdvdv.exe 2844 pjddj.exe 2908 llxxffl.exe 2876 1thhtb.exe 2384 jddjv.exe 3008 1llxlrf.exe 2408 bnthnh.exe 2884 7hhntb.exe 712 vjvdp.exe 1112 pjdjv.exe 448 frlxfxx.exe -
resource yara_rule behavioral1/memory/1916-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-81-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2684-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-185-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1952-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-481-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2176-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-753-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1472-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-785-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1472-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-1173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-1222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-1231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-1260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-1298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-1342-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2428 1916 9422d25001d2c78da94d02e0ece1f35af370b0787833be5d183b44ba42aef98eN.exe 30 PID 1916 wrote to memory of 2428 1916 9422d25001d2c78da94d02e0ece1f35af370b0787833be5d183b44ba42aef98eN.exe 30 PID 1916 wrote to memory of 2428 1916 9422d25001d2c78da94d02e0ece1f35af370b0787833be5d183b44ba42aef98eN.exe 30 PID 1916 wrote to memory of 2428 1916 9422d25001d2c78da94d02e0ece1f35af370b0787833be5d183b44ba42aef98eN.exe 30 PID 2428 wrote to memory of 1000 2428 rlrrlrr.exe 31 PID 2428 wrote to memory of 1000 2428 rlrrlrr.exe 31 PID 2428 wrote to memory of 1000 2428 rlrrlrr.exe 31 PID 2428 wrote to memory of 1000 2428 rlrrlrr.exe 31 PID 1000 wrote to memory of 2312 1000 bnbbhh.exe 32 PID 1000 wrote to memory of 2312 1000 bnbbhh.exe 32 PID 1000 wrote to memory of 2312 1000 bnbbhh.exe 32 PID 1000 wrote to memory of 2312 1000 bnbbhh.exe 32 PID 2312 wrote to memory of 2752 2312 9bttbb.exe 33 PID 2312 wrote to memory of 2752 2312 9bttbb.exe 33 PID 2312 wrote to memory of 2752 2312 9bttbb.exe 33 PID 2312 wrote to memory of 2752 2312 9bttbb.exe 33 PID 2752 wrote to memory of 2720 2752 5rfxfll.exe 34 PID 2752 wrote to memory of 2720 2752 5rfxfll.exe 34 PID 2752 wrote to memory of 2720 2752 5rfxfll.exe 34 PID 2752 wrote to memory of 2720 2752 5rfxfll.exe 34 PID 2720 wrote to memory of 2624 2720 3nhhnt.exe 35 PID 2720 wrote to memory of 2624 2720 3nhhnt.exe 35 PID 2720 wrote to memory of 2624 2720 3nhhnt.exe 35 PID 2720 wrote to memory of 2624 2720 3nhhnt.exe 35 PID 2624 wrote to memory of 2784 2624 3dpjd.exe 36 PID 2624 wrote to memory of 2784 2624 3dpjd.exe 36 PID 2624 wrote to memory of 2784 2624 3dpjd.exe 36 PID 2624 wrote to memory of 2784 2624 3dpjd.exe 36 PID 2784 wrote to memory of 2548 2784 9lrxlrr.exe 37 PID 2784 wrote to memory of 2548 2784 9lrxlrr.exe 37 PID 2784 wrote to memory of 2548 2784 9lrxlrr.exe 37 PID 2784 wrote to memory of 2548 2784 9lrxlrr.exe 37 PID 2548 wrote to memory of 2684 2548 nbtnhh.exe 38 PID 2548 wrote to memory of 2684 2548 nbtnhh.exe 38 PID 2548 wrote to memory of 2684 2548 nbtnhh.exe 38 PID 2548 wrote to memory of 2684 2548 nbtnhh.exe 38 PID 2684 wrote to memory of 2544 2684 ffrrlll.exe 39 PID 2684 wrote to memory of 2544 2684 ffrrlll.exe 39 PID 2684 wrote to memory of 2544 2684 ffrrlll.exe 39 PID 2684 wrote to memory of 2544 2684 ffrrlll.exe 39 PID 2544 wrote to memory of 1588 2544 1ntnnn.exe 40 PID 2544 wrote to memory of 1588 2544 1ntnnn.exe 40 PID 2544 wrote to memory of 1588 2544 1ntnnn.exe 40 PID 2544 wrote to memory of 1588 2544 1ntnnn.exe 40 PID 1588 wrote to memory of 1148 1588 3rlxlll.exe 41 PID 1588 wrote to memory of 1148 1588 3rlxlll.exe 41 PID 1588 wrote to memory of 1148 1588 3rlxlll.exe 41 PID 1588 wrote to memory of 1148 1588 3rlxlll.exe 41 PID 1148 wrote to memory of 1900 1148 nbhhhh.exe 42 PID 1148 wrote to memory of 1900 1148 nbhhhh.exe 42 PID 1148 wrote to memory of 1900 1148 nbhhhh.exe 42 PID 1148 wrote to memory of 1900 1148 nbhhhh.exe 42 PID 1900 wrote to memory of 1552 1900 vpddj.exe 43 PID 1900 wrote to memory of 1552 1900 vpddj.exe 43 PID 1900 wrote to memory of 1552 1900 vpddj.exe 43 PID 1900 wrote to memory of 1552 1900 vpddj.exe 43 PID 1552 wrote to memory of 2420 1552 9hbbhb.exe 44 PID 1552 wrote to memory of 2420 1552 9hbbhb.exe 44 PID 1552 wrote to memory of 2420 1552 9hbbhb.exe 44 PID 1552 wrote to memory of 2420 1552 9hbbhb.exe 44 PID 2420 wrote to memory of 584 2420 pjdjp.exe 45 PID 2420 wrote to memory of 584 2420 pjdjp.exe 45 PID 2420 wrote to memory of 584 2420 pjdjp.exe 45 PID 2420 wrote to memory of 584 2420 pjdjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9422d25001d2c78da94d02e0ece1f35af370b0787833be5d183b44ba42aef98eN.exe"C:\Users\Admin\AppData\Local\Temp\9422d25001d2c78da94d02e0ece1f35af370b0787833be5d183b44ba42aef98eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\bnbbhh.exec:\bnbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\9bttbb.exec:\9bttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\5rfxfll.exec:\5rfxfll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3nhhnt.exec:\3nhhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3dpjd.exec:\3dpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\9lrxlrr.exec:\9lrxlrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nbtnhh.exec:\nbtnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\ffrrlll.exec:\ffrrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\1ntnnn.exec:\1ntnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3rlxlll.exec:\3rlxlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\nbhhhh.exec:\nbhhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\vpddj.exec:\vpddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\9hbbhb.exec:\9hbbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\pjdjp.exec:\pjdjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\3bbbbh.exec:\3bbbbh.exe17⤵
- Executes dropped EXE
PID:584 -
\??\c:\ddvjv.exec:\ddvjv.exe18⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rrlxffx.exec:\rrlxffx.exe19⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nhhbtn.exec:\nhhbtn.exe20⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5lfrrxl.exec:\5lfrrxl.exe21⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hbnnnb.exec:\hbnnnb.exe22⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jjdpd.exec:\jjdpd.exe23⤵
- Executes dropped EXE
PID:712 -
\??\c:\9bnhhb.exec:\9bnhhb.exe24⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5pjvv.exec:\5pjvv.exe25⤵
- Executes dropped EXE
PID:448 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe26⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9dvdj.exec:\9dvdj.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\bhbnht.exec:\bhbnht.exe28⤵
- Executes dropped EXE
PID:876 -
\??\c:\3vjpv.exec:\3vjpv.exe29⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nhnttt.exec:\nhnttt.exe30⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nhbbhn.exec:\nhbbhn.exe31⤵
- Executes dropped EXE
PID:1156 -
\??\c:\xxrxxfr.exec:\xxrxxfr.exe32⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nhbbnb.exec:\nhbbnb.exe33⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hhnbbh.exec:\hhnbbh.exe34⤵
- Executes dropped EXE
PID:2432 -
\??\c:\frrrxrx.exec:\frrrxrx.exe35⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bbtntb.exec:\bbtntb.exe36⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9tbtbb.exec:\9tbtbb.exe37⤵
- Executes dropped EXE
PID:1920 -
\??\c:\dpjjj.exec:\dpjjj.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xrxxxrf.exec:\xrxxxrf.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5nbbbb.exec:\5nbbbb.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tnhhnn.exec:\tnhhnn.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pjvvv.exec:\pjvvv.exe42⤵
- Executes dropped EXE
PID:2520 -
\??\c:\frxrxxx.exec:\frxrxxx.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5rrrrlr.exec:\5rrrrlr.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1tttht.exec:\1tttht.exe45⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vjvvj.exec:\vjvvj.exe46⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jjdpj.exec:\jjdpj.exe47⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe48⤵
- Executes dropped EXE
PID:2268 -
\??\c:\7nhhnh.exec:\7nhhnh.exe49⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbhbbb.exec:\hbhbbb.exe50⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vjvjp.exec:\vjvjp.exe51⤵
- Executes dropped EXE
PID:1508 -
\??\c:\1rflllr.exec:\1rflllr.exe52⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tnbhnn.exec:\tnbhnn.exe53⤵
- Executes dropped EXE
PID:1904 -
\??\c:\hthbbb.exec:\hthbbb.exe54⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pdvdv.exec:\pdvdv.exe55⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pjddj.exec:\pjddj.exe56⤵
- Executes dropped EXE
PID:2844 -
\??\c:\llxxffl.exec:\llxxffl.exe57⤵
- Executes dropped EXE
PID:2908 -
\??\c:\1thhtb.exec:\1thhtb.exe58⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jddjv.exec:\jddjv.exe59⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1llxlrf.exec:\1llxlrf.exe60⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bnthnh.exec:\bnthnh.exe61⤵
- Executes dropped EXE
PID:2408 -
\??\c:\7hhntb.exec:\7hhntb.exe62⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vjvdp.exec:\vjvdp.exe63⤵
- Executes dropped EXE
PID:712 -
\??\c:\pjdjv.exec:\pjdjv.exe64⤵
- Executes dropped EXE
PID:1112 -
\??\c:\frlxfxx.exec:\frlxfxx.exe65⤵
- Executes dropped EXE
PID:448 -
\??\c:\hbnnbh.exec:\hbnnbh.exe66⤵PID:1844
-
\??\c:\pjvvp.exec:\pjvvp.exe67⤵PID:920
-
\??\c:\djpjj.exec:\djpjj.exe68⤵PID:1016
-
\??\c:\frrrrrl.exec:\frrrrrl.exe69⤵PID:768
-
\??\c:\5hnnhb.exec:\5hnnhb.exe70⤵PID:1484
-
\??\c:\bnttbb.exec:\bnttbb.exe71⤵PID:2356
-
\??\c:\ppddj.exec:\ppddj.exe72⤵PID:2176
-
\??\c:\rfrrxff.exec:\rfrrxff.exe73⤵PID:1688
-
\??\c:\tbnhhb.exec:\tbnhhb.exe74⤵PID:2240
-
\??\c:\1thbtt.exec:\1thbtt.exe75⤵PID:1548
-
\??\c:\3vdpj.exec:\3vdpj.exe76⤵PID:1564
-
\??\c:\3xlfxxx.exec:\3xlfxxx.exe77⤵PID:1376
-
\??\c:\xrrxflr.exec:\xrrxflr.exe78⤵PID:2476
-
\??\c:\7bbtnn.exec:\7bbtnn.exe79⤵PID:1540
-
\??\c:\pjvvd.exec:\pjvvd.exe80⤵PID:2216
-
\??\c:\9xxfllr.exec:\9xxfllr.exe81⤵PID:2236
-
\??\c:\frxxrrr.exec:\frxxrrr.exe82⤵PID:2724
-
\??\c:\5tttbh.exec:\5tttbh.exe83⤵PID:2280
-
\??\c:\dvjjj.exec:\dvjjj.exe84⤵PID:2672
-
\??\c:\jjdjv.exec:\jjdjv.exe85⤵PID:2520
-
\??\c:\frfffxf.exec:\frfffxf.exe86⤵PID:2540
-
\??\c:\btntbn.exec:\btntbn.exe87⤵PID:2548
-
\??\c:\1dpdv.exec:\1dpdv.exe88⤵PID:2512
-
\??\c:\dvpjp.exec:\dvpjp.exe89⤵PID:3036
-
\??\c:\5rflrrx.exec:\5rflrrx.exe90⤵PID:2084
-
\??\c:\hhtbhh.exec:\hhtbhh.exe91⤵PID:1888
-
\??\c:\vvjjp.exec:\vvjjp.exe92⤵PID:1720
-
\??\c:\pdddj.exec:\pdddj.exe93⤵PID:1900
-
\??\c:\5flllll.exec:\5flllll.exe94⤵PID:1884
-
\??\c:\5lxllxl.exec:\5lxllxl.exe95⤵
- System Location Discovery: System Language Discovery
PID:1328 -
\??\c:\bntttn.exec:\bntttn.exe96⤵PID:1252
-
\??\c:\dpppd.exec:\dpppd.exe97⤵PID:1224
-
\??\c:\jdpdv.exec:\jdpdv.exe98⤵PID:2880
-
\??\c:\fxlrffx.exec:\fxlrffx.exe99⤵PID:2860
-
\??\c:\tthtbb.exec:\tthtbb.exe100⤵PID:2908
-
\??\c:\9tnbbb.exec:\9tnbbb.exe101⤵PID:2912
-
\??\c:\pjpvv.exec:\pjpvv.exe102⤵PID:2996
-
\??\c:\9xffffr.exec:\9xffffr.exe103⤵
- System Location Discovery: System Language Discovery
PID:2152 -
\??\c:\xlxrrll.exec:\xlxrrll.exe104⤵PID:804
-
\??\c:\1thhbt.exec:\1thhbt.exe105⤵PID:956
-
\??\c:\jdvdj.exec:\jdvdj.exe106⤵PID:864
-
\??\c:\xxlxxxx.exec:\xxlxxxx.exe107⤵PID:1636
-
\??\c:\frfxllr.exec:\frfxllr.exe108⤵PID:1472
-
\??\c:\hbbbhh.exec:\hbbbhh.exe109⤵PID:1080
-
\??\c:\ppdjd.exec:\ppdjd.exe110⤵PID:1480
-
\??\c:\9jvvj.exec:\9jvvj.exe111⤵PID:1468
-
\??\c:\5xfxrrr.exec:\5xfxrrr.exe112⤵PID:768
-
\??\c:\tntthh.exec:\tntthh.exe113⤵PID:2340
-
\??\c:\ppddd.exec:\ppddd.exe114⤵PID:1932
-
\??\c:\vpjdj.exec:\vpjdj.exe115⤵PID:2176
-
\??\c:\lffflrf.exec:\lffflrf.exe116⤵PID:1688
-
\??\c:\7thnnt.exec:\7thnnt.exe117⤵PID:2120
-
\??\c:\vvjpv.exec:\vvjpv.exe118⤵PID:2304
-
\??\c:\7dvdv.exec:\7dvdv.exe119⤵PID:1964
-
\??\c:\rfrxffr.exec:\rfrxffr.exe120⤵PID:2308
-
\??\c:\7lxfxff.exec:\7lxfxff.exe121⤵PID:1592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-